---
title: "Get client firewall session logs"
method: GET
path: "/network-monitoring/v1/client-firewall-sessions"
tags: ["Firewall Session"]
---

# Get client firewall session logs

`GET /network-monitoring/v1/client-firewall-sessions`

## Request

- Base URL: `https://sso.common.cloud.hpe.com`
- URL: `https://sso.common.cloud.hpe.com/network-monitoring/v1/client-firewall-sessions`
- Auth: OAuth 2
  - Client credentials
  - Token URL: `https://sso.common.cloud.hpe.com/as/token.oauth2`
- TypeScript: <https://skmtc.dev/arubanetworks/apis/authorization/docs/network-monitoring/v1/client-firewall-sessions/get.ts> (a function with typed inputs; its response is checked against the schema)

This API endpoint retrieves sessions logs from access points, CX switches and gateways in a site based on the given client MAC and the filter.

## Query parameters

- `site-id` string, const, required
- `start-at` string, date-time, required
- `end-at` string, date-time, required
- `client-mac` string, const, required
- `filter` string, const, required
- `limit` integer
- `next` string
- `offset` integer

## Response `200`

Successful operation

- ClientSessionLogResponse: List of client firewall session logs.
  - `items` SessionItems[], required
    - `type` string, const, required: Resource type.
    - `id` string, string, required: Resource ID: session_timestamp-src_ip-client_mac-dest_ip.
    - `timestamp` string, const: The timestamp of the session in epoch milliseconds.
    - `serialNumber` string, const: The serial number of the device reporting the session.
    - `clientUsername` string, const: The logged in username of the client.
    - `clientMac` string, const: The MAC address of the client.
    - `sourceIp` string, ipv4: The IP address of the client.
    - `destinationIp` string, ipv4: The IP address of the destination.
    - `clientRole` string, const: The role assigned to the client.
    - `ssidName` string, const: The SSID that the client was connected to.
    - `tunneledTraffic` boolean: Boolean value indicating whether the client traffic was tunneled to the gateway or not.
    - `clientConnectionType` string, const: This represents whether the client is wireless or wired.
    - `vlanId` integer: The client VLAN.
    - `txBytes` integer: The transmitted bytes.
    - `rxBytes` integer: The received bytes.
    - `sessionType` string, const: String representing whether the session was permitted or denied.
    - `applicationName` string, const: The application that the client was accessing.
    - `applicationCategories` string[]: List of categories that applications belong to.
    - `webUrl` string, const: The URL of the application that was accessed by the client.
    - `webCategories` string, const: The category that the web URL belongs to.
    - `webReputation` string, const: Value representing the risk level of the web URL.
    - `blockedSessionReason` string, const: A string representing the reason of a blocked/denied session.
    - `deviceType` string, const: A string representing the device type that pertains to the current entry.
    - `sessionCount` integer: The number of blocked sessions.
    - `clientHostname` string, const: A string representing the source client hostname.
    - `tlsServerVersion` string, const: A string representing the TLS version.
    - `certificateExpiryDate` string, const: A string representing the timestamp of the certificate expiry date.
    - `destinationLocation` string, const: The country name of the destination.
  - `next` string, required: Specifies the pagination cursor for the next page of resources.
  - `offset` integer
  - `count` integer, required: Number of items in the response.
  - `total` integer, required: Specifies the total number of items available for a given filter query.

## Other responses

- `400`: Invalid input received.
- `401`: Unauthorized. Authentication credentials are required or invalid.
- `403`: Forbidden: Access is denied.
- `404`: Not Found error.
- `429`: Too Many Requests. The user has sent too many requests in a given amount of time.
- `500`: Internal Server Error. An unexpected error occurred on the server.
- `503`: Service unavailable.

---

[API](https://skmtc.dev/arubanetworks/apis/authorization.md) - [All operations](https://skmtc.dev/arubanetworks/apis/authorization/llms.txt) - [OpenAPI document](https://skmtc.dev/arubanetworks/apis/authorization/revisions/74c95058b11f?raw)